nezha_domains

mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-19 09:40:12 +00:00

T

naibaandnaiba/CloudCode 6661d6a7fc fix(rpc): bind io_stream sessions to creator to prevent terminal/fm hijack

createTerminal and createFM correctly check server ownership before
issuing a stream UUID, but terminalStream and fmStream only verified
that the UUID existed. Any authenticated user holding a valid stream
UUID could attach to it, gaining the original creator's live shell or
file-manager session — and the UUID is exposed via URL path (referer
leaks, access logs, browser history, frontend error reporters).

Bind the creator user ID into ioStreamContext at CreateStream time,
expose StreamOwnership and IsStreamAuthorizedForUser, and check
ownership in terminalStream/fmStream before the WebSocket upgrade so a
rejected attempt does not tear down the legitimate stream via defer.

NAT streams are also routed through CreateStream(_, 0); they are not
reachable from /ws/terminal or /ws/file so a sentinel user ID is fine.

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>

2026-05-18 15:16:40 +00:00

.devcontainer

ci: use go1.24 (#1012 )

2025-02-28 22:19:57 +08:00

.github

chore: bump Go to 1.26, update dependencies and frontend templates

2026-03-20 11:23:03 +00:00

cmd/dashboard

fix(rpc): bind io_stream sessions to creator to prevent terminal/fm hijack

2026-05-18 15:16:40 +00:00

model

fix(ddns): apply SSRF defense to webhook provider

2026-05-18 15:14:27 +00:00

pkg

fix(ddns): apply SSRF defense to webhook provider

2026-05-18 15:14:27 +00:00

proto

improve: geoip

2025-02-09 14:39:12 +08:00

script

feat: upgrade frontend

2025-03-22 22:44:25 +08:00

service

fix(rpc): bind io_stream sessions to creator to prevent terminal/fm hijack

2026-05-18 15:16:40 +00:00

.gitattributes

💄 UI: 前端优化调整

2021-01-30 11:22:59 +08:00

.gitignore

Refactor: Load UserTemplates from embedded yaml file (#575 )

2024-12-10 21:57:20 +08:00

.goreleaser.yml

feat(v2.0.0): tsdb (#1162 )

2026-02-15 13:13:33 +08:00

Dockerfile

fix: embed tzdata to correct container timezone (#1126 )

2025-10-03 09:33:12 +08:00

go.mod

chore(deps): upgrade go modules to latest

2026-05-17 02:40:09 +00:00

go.sum

chore(deps): upgrade go modules to latest

2026-05-17 02:40:09 +00:00

LICENSE

Create LICENSE

2021-03-22 17:41:38 +08:00

README.md

update contributors[no ci]

2026-03-01 11:33:11 +08:00

SECURITY.md

Create SECURITY.md [skip ci]

2022-04-18 10:47:29 +08:00

README.md

LOGO designed by 熊大 .

:trollface: Nezha Monitoring: Self-hostable, lightweight, servers and websites monitoring and O&M tool.

Supports monitoring system status, HTTP (SSL certificate change, upcoming expiration, expired), TCP, Ping and supports push alerts, run scheduled tasks and web terminal.

>> Telegram Channel: 哪吒监控（中文通知频道）
>> Telegram Group: Nezha Monitoring Global (English Only), 哪吒监控（中文群组）

>> Use Cases | 我们的用户 (Google)